UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never
registered for either. Nothing clears it there, and userspace sees:
- /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
while it is swapped out and after it is faulted back in.
- MADV_COLLAPSE fails with EINVAL on a range containing it, because the
collapse scan bails on a swap entry with the uffd bit set.
- With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
do_swap_page() carries the bit into the present PTE and, since the
destination isn't WP-registered, also makes it writable:
WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
Call Trace:
set_ptes+0x67/0xc0
do_swap_page+0x990/0xfe0
__handle_mm_fault+0x7d0/0xeb0
handle_mm_fault+0x9c/0x250
do_user_addr_fault+0x207/0x650
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x26/0x30
Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
one that isn't, on a page that is swapped out at the time. It hasn't
been seen in practice.
A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot. Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.
The WP case has been there since v6.8, where UFFDIO_MOVE was added.
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Cc: <[email protected]>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <[email protected]>
---
mm/userfaultfd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 74f04c323c50f..f39f109f17989 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struct *mm, struct
vm_area_struct *dst_vma,
orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
if (pgtable_supports_soft_dirty())
orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+ orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
if (userfaultfd_rwp(dst_vma))
orig_src_pte = pte_swp_mkuffd(orig_src_pte);
--
2.53.0
